new file mode 100644
@@ -0,0 +1,127 @@
+From 8a48af0e3ed15ce0e60273de30a073ae6419489e Mon Sep 17 00:00:00 2001
+From: Takatoshi Kondo <redboltz@gmail.com>
+Date: Tue, 25 Aug 2026 11:44:54 +0900
+Subject: [PATCH] Fix #1181
+
+Fix integer overflow on msgpack_unpacker_expand_buffer().
+
+CVE: CVE-2026-72854
+Upstream-Status: Backport [https://github.com/msgpack/msgpack-c/commit/8a48af0e3ed15ce0e60273de30a073ae6419489e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ .gitignore | 2 ++
+ CHANGELOG.md | 3 +++
+ src/unpack.c | 9 +++++++-
+ test/streaming_c.cpp | 51 ++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 64 insertions(+), 1 deletion(-)
+
+diff --git a/.gitignore b/.gitignore
+index b9dc789b..f046aab4 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -27,6 +27,8 @@ Makefile
+ .deps
+ .libs
+
++build
++
+ # Files generated by make.
+ *.o
+ *.so
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index fc2ffa5b..9e30edfe 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -1,3 +1,6 @@
++# 2026-08-25 version 6.1.0-patched
++ * Fix integer overflow on msgpack_unpacker_expand_buffer(). (#1182)
++
+ # 2024-08-17 version 6.1.0
+ * Add object initializer functions (#1137)
+ * Fix cmake warnings (#1133, #1137)
+diff --git a/src/unpack.c b/src/unpack.c
+index 9341cb08..2d02a721 100644
+--- a/src/unpack.c
++++ b/src/unpack.c
+@@ -442,7 +442,11 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size)
+
+ if(mpac->off == COUNTER_SIZE) {
+ char* tmp;
+- size_t next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE
++ size_t next_size;
++ if(size > SIZE_MAX - mpac->used) {
++ return false;
++ }
++ next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE
+ while(next_size < size + mpac->used) {
+ size_t tmp_next_size = next_size * 2;
+ if (tmp_next_size <= next_size) {
+@@ -464,6 +468,9 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size)
+ char* tmp;
+ size_t next_size = mpac->initial_buffer_size; // include COUNTER_SIZE
+ size_t not_parsed = mpac->used - mpac->off;
++ if(size > SIZE_MAX - not_parsed - COUNTER_SIZE) {
++ return false;
++ }
+ while(next_size < size + not_parsed + COUNTER_SIZE) {
+ size_t tmp_next_size = next_size * 2;
+ if (tmp_next_size <= next_size) {
+diff --git a/test/streaming_c.cpp b/test/streaming_c.cpp
+index d75bfbe5..ebf73362 100644
+--- a/test/streaming_c.cpp
++++ b/test/streaming_c.cpp
+@@ -192,3 +192,54 @@ TEST(streaming, basic_with_size)
+ msgpack_unpacker_free(unp);
+ msgpack_sbuffer_free(buffer);
+ }
++
++// https://github.com/msgpack/msgpack-c/issues/1181
++TEST(streaming, reserve_buffer_overflow_rewound)
++{
++ msgpack_unpacker mpac;
++ ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8));
++
++ // off == COUNTER_SIZE path: size + used would wrap
++ size_t request = SIZE_MAX - 2;
++ EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request));
++
++ // a sane request still works
++ EXPECT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, 64));
++ EXPECT_GE(msgpack_unpacker_buffer_capacity(&mpac), static_cast<size_t>(64));
++
++ msgpack_unpacker_destroy(&mpac);
++}
++
++TEST(streaming, reserve_buffer_overflow_not_rewound)
++{
++ msgpack_unpacker mpac;
++ ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8));
++
++ // consume part of the buffer so off != COUNTER_SIZE
++ msgpack_sbuffer sbuf;
++ msgpack_sbuffer_init(&sbuf);
++ msgpack_packer pk;
++ msgpack_packer_init(&pk, &sbuf, msgpack_sbuffer_write);
++ msgpack_pack_int(&pk, 1);
++ msgpack_pack_int(&pk, 2);
++
++ ASSERT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, sbuf.size));
++ memcpy(msgpack_unpacker_buffer(&mpac), sbuf.data, sbuf.size);
++ msgpack_unpacker_buffer_consumed(&mpac, sbuf.size);
++
++ msgpack_unpacked result;
++ msgpack_unpacked_init(&result);
++ ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result));
++ EXPECT_EQ(1, result.data.via.i64);
++
++ size_t request = SIZE_MAX - 2;
++ EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request));
++
++ // remaining data must still be parsable
++ ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result));
++ EXPECT_EQ(2, result.data.via.i64);
++
++ msgpack_unpacked_destroy(&result);
++ msgpack_sbuffer_destroy(&sbuf);
++ msgpack_unpacker_destroy(&mpac);
++}
@@ -7,7 +7,9 @@ LIC_FILES_CHKSUM = "file://NOTICE;md5=7a858c074723608e08614061dc044352 \
file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c \
"
-SRC_URI = "git://github.com/msgpack/msgpack-c;branch=c_master;protocol=https"
+SRC_URI = "git://github.com/msgpack/msgpack-c;branch=c_master;protocol=https \
+ file://CVE-2026-72854.patch \
+"
SRCREV = "445880108a1d171f755ff6ac77e03fbebbb23729"
inherit cmake pkgconfig